Same reply if the email is unknown

Unknown addresses get the same generic copy. Kumir does not 404.

POST /api/auth/forgot and POST /api/v1/auth/forgot always return the same generic message. Unknown emails do not 404.

The copy is: If that email is on Kumir, we sent reset instructions. Check spam if you don’t see it.